Typical user authentication systems and procedures use passwords to authenticate the identity of the user. In many instances, Web sites are authenticated using SSL (Secure Sockets Layer) or other protocols. SSL is a protocol for securely transmitting information via the Internet. When using SSL, a Web site is authenticated via its certificate. The user seeking access to the Web site is then authenticated by username and password.
Although passwords are commonly used to authenticate users, passwords are subject to various attacks, such as phishing attacks, social engineering attacks, dictionary attacks and the like. Typically, longer passwords with combinations of letters and numbers provide a higher level of security. However, these longer passwords are more difficult for users to remember. Additionally, passwords provide a single factor of authentication by requiring the user to provide something they know. This factor does not provide any physical authentication of the user's identity. Thus, any person can access the user's Web-based accounts and information if they gain knowledge of the user's password and username.
Another potential threat associated with user passwords is commonly referred to as “Man in the Browser” attack. This type of attack uses a malicious software application (commonly known as “malware”) running in the internet browser application while the user is, for example, logging into a web site, accessing confidential information, or performing a financial transaction. One implementation of this attack obtains access to the user's password as the user provides the password to the internet browser application. Once the user's password is obtained, the malware application can perform a variety of malicious actions associated with the user's account.
Therefore, it is desirable to provide a user authentication method and system that provides a more secure authentication of the user than commonly used password-based methods and systems.
Throughout the description, similar reference numbers may be used to identify similar elements.